Resolving Greyed-Out Picture Tree Navigation and Area Authorization Errors on PCS 7 OS Clients

In SIMATIC PCS 7 WinCC operator stations, experiencing greyed-out Picture Tree navigation buttons and receiving 'No authorization for this area available' alarms when clicking the alarm list indicates a breakdown between the Windows user credentials, WinCC User Administrator security levels, and Plant Hierarchy area assignments. This failure occurs when SIMATIC Logon is active but the user group is not mapped in User Administrator, when OS Server packages have not been re-generated and downloaded to OS Clients, or when the user lacks authorization for the root node of the Picture Tree. To resolve this, verify SIMATIC Logon group synchronization, assign authorizations per area, re-generate server data, and download the updated OS server and client projects.

WinCC Area Authorization and Picture Tree Security Framework

In SIMATIC PCS 7, multi-user client-server architectures enforce process security through the integration of the Plant Hierarchy (TH), WinCC Picture Tree Manager, and WinCC User Administrator. When an engineer organizes CFC charts into technological folders (e.g., Area 1: Raw Materials, Area 2: Reactor, Area 3: Separation), the OS compilation wizard maps these folders into discrete Areas.

The Picture Tree Manager generates operator navigation bars (Overview Area, Working Area, and Alarm Line) dynamically. Every picture button inside the Picture Tree inherits the authorization requirements of its parent area node. When an operator logs into an OS Client, the system evaluates their user token. If the user possesses authorization for an area, the button is enabled and illuminated. If authorization is absent, the Picture Tree button is greyed out (disabled), and clicking an alarm originating from that area inside the Alarm List triggers the security warning: 'No authorization for this area available'.

Root Causes of Greyed-Out Navigation Buttons and Access Denials

Technical investigation into authorization failures across OS Clients reveals four common breakdowns:

SIMATIC Logon Domain Group Synchronization Gap: In modern PCS 7 plants, user authentication is managed centrally via SIMATIC Logon. If a new user group is created in Windows on the OS Server or Active Directory Domain Controller, WinCC User Administrator does not automatically grant access to it. The Windows group name must be explicitly created inside WinCC User Administrator, or imported via SIMATIC Logon, with identical spelling and specific area rights assigned.
Missing Authorization on Top-Level Hierarchy Nodes: Engineers frequently assign rights only to child areas (e.g., Area_1) while omitting rights on the root plant folder (e.g., Plant). Because the Picture Tree navigation container evaluates root privileges before rendering subordinate branch buttons, omitting root access greys out the entire tree.
Outdated Server Data Packages on OS Clients: When authorizations or areas are modified on the OS Server, the internal security token definitions change. If the OS Server project's Server Data (*.pck) is not re-generated and downloaded to the OS Clients, the clients evaluate incoming credentials against stale security tables.
Local Windows User Login vs. Central Domain Login: If the operator logs into Windows on the local client PC using a local workstation account rather than the central domain/server user account, SIMATIC Logon rejects the credentials and drops the session into default 'Anonymous / Guest' privileges.

Authorization Levels and Security Mapping Matrix

The following table summarizes standard PCS 7 authorization levels and required assignments for area navigation:

Authorization LevelStandard Role NamePermission ScopeRequired for Picture Tree Navigation?Level 1User ManagementAdminister users in User AdministratorNo (Admin only)Level 5Process MonitoringOpen process pictures, view trendsYes (Mandatory per area)Level 6Process ControllingModify setpoints, operate valves/motorsYes (For active manipulation)Level 1001+Area Specific AccessDynamic rights assigned per plant nodeYes (Must cover target Area)SIMATIC LogonWindows Group MappingMaps OS Windows groups to WinCC rightsMandatory if SIMATIC Logon activeServer Data (.pck)Cross-Station PackageDistributes area tables to OS ClientsMust be re-exported after edits

Step-by-Step Procedure to Establish Plant Area Authorization

To resolve greyed-out picture navigation and restore full operator control on OS Clients:

Synchronize Groups in WinCC User Administrator on the OS Server:
- On the Engineering Station, open the master OS Server project in WinCC Explorer.
- Open User Administrator.
- If using SIMATIC Logon, select SIMATIC Logon -> Import Groups and select the Windows group (e.g., Operators_AreaA).
- If configuring standard WinCC users, create the exact group name.
- Select the group, and in the right pane, enable Authorization Level 5 (Process Monitoring) and Authorization Level 6 (Higher Process Controlling).
Assign Authorizations per Area:
- In User Administrator, expand the Authorizations per Area tree.
- Ensure that the group has authorization enabled for both the Plant Root Node and the specific operational areas.
- Save the User Administrator configuration.
Re-generate OS Server Data and Compile OS:
- In WinCC Explorer, right-click Server Data and select Generate.
- In SIMATIC Manager, right-click the OS Server project and select Compile.
- Select Tags and messages and compile changes (or entire OS if hierarchy changed).
Download to OS Server and OS Clients:
- In SIMATIC Manager, select the OS Server project and execute PLC -> Download to transfer updated security databases to the redundant OS servers.
- Select each OS Client project and execute PLC -> Download to deploy updated server packages and picture caches.
Log In on the OS Client:
- On the physical OS Client, log out of WinCC Runtime (System -> Log Off).
- Log back in using the authorized user credentials. The Picture Tree buttons will immediately illuminate and become responsive.

Verification

Verify operational access across the client fleet:
1. Log into the OS Client; confirm that the Picture Tree navigation buttons display active colors and respond to clicks.
2. Navigate to each process area; confirm that pictures load cleanly without throwing access denial dialogs.
3. Open the WinCC Alarm List; click on an active alarm line and verify that the system opens the associated technological faceplate or graphic without displaying 'No authorization for this area available'.
4. Check the WinCC system log (WinCC_Sys.log); verify that user login events are logged with valid area tokens.

Limitations and Operational Precautions

Redundant Server Synchronization: Always verify that User Administrator modifications are deployed to both redundant OS servers; mismatched databases cause login failures during server failovers.
Client Cache Purging: If an OS Client continues to grey out navigation after download, close WinCC Runtime on the client, delete temporary files in the client project folder, and restart.
Domain Controller Latency: When utilizing SIMATIC Logon with central Active Directory, network latency or domain controller communication drops will default clients to offline guest rights.

Engineer FAQ

Why are Picture Tree buttons greyed out on OS Clients but active on the OS Server?

The OS Clients are running with an outdated Server Data package that does not reflect recent User Administrator changes made on the server.

What authorization level is required to click and open a process picture?

By default, PCS 7 requires Authorization Level 5 (Process Monitoring) in the specific area to which the picture is assigned in the Plant Hierarchy.

Why does the alarm list state 'No authorization for this area available'?

The logged-in user lacks Level 5 authorization for the technological plant area where the alarm was generated.

Do I need to download the OS Client after changing User Administrator settings?

Yes. If using a multi-user project, server data must be regenerated and OS Clients updated to receive the new security mapping.

Technical References

Related Tags

Picture Tree
User Administrator
Area Authorization
OS Client
SIMATIC Logon
Plant Hierarchy

6 respuestas

Resolving Greyed-Out Picture Tree Navigation and Area Authorization Errors on PCS 7 OS Clients